> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Vault

> Store API keys, tokens, and secrets in the encrypted organization Vault and reference them securely from Ravenna workflows and integrations.

Vault provides encrypted credential storage at the organization level. Use it to securely store API keys, tokens, and other secrets that your <Tooltip headline="Workflows" tip="Automated sequences of actions triggered by events" cta="Learn about workflows" href="/documentation/automate/workflows/overview">workflows</Tooltip> and integrations can reference at runtime.

## Overview

| Property | Detail                                                                                 |
| -------- | -------------------------------------------------------------------------------------- |
| Scope    | Organization                                                                           |
| Access   | Organization admin only                                                                |
| Location | Settings > Vault                                                                       |
| Purpose  | Encrypted storage for API keys, tokens, and secrets used by workflows and integrations |

***

## Credential model

### Properties

| Field      | Description                                                                                      |
| ---------- | ------------------------------------------------------------------------------------------------ |
| Name       | Unique identifier within the organization. Used to select credentials in workflow configuration. |
| Hint       | First and last few characters of the value, displayed for identification purposes.               |
| Type       | The kind of credential stored (API key, token, password).                                        |
| Created at | Timestamp when the credential was first created.                                                 |
| Updated at | Timestamp of the most recent update to the credential.                                           |

### Operations

| Operation   | Access level       | Notes                                                                      |
| ----------- | ------------------ | -------------------------------------------------------------------------- |
| Create      | Organization admin | Name must be unique per organization. Value is encrypted immediately.      |
| Read (list) | Organization admin | Returns name, hint, and metadata only. Values are never returned.          |
| Update      | Organization admin | Can change name or value. Value must be re-entered (never pre-filled).     |
| Delete      | Organization admin | Permanent. May break workflows or integrations referencing the credential. |

### Constraints

* Credential names must be unique within an organization.
* Values cannot be viewed after creation. Only a character hint is available for identification.
* Only organization admins can manage vault credentials.
* Deleting a credential does not automatically update workflows or integrations that reference it. Verify usage before deletion.
* Credentials are encrypted at rest using AES-256-GCM envelope encryption.

***

## Workflow integration

Vault credentials are referenced in the HTTP Request workflow action through authentication configuration fields.

**Supported authentication types:**

| Auth type    | Vault-eligible field | Header format                                      |
| ------------ | -------------------- | -------------------------------------------------- |
| API Key      | API key value        | Configurable header name (default: `X-API-Key`)    |
| Bearer Token | Token value          | `Authorization: Bearer <token>`                    |
| Basic Auth   | Password             | `Authorization: Basic <base64(username:password)>` |

Credentials are decrypted at runtime only during workflow execution. They are never exposed in the workflow builder, logs, or API responses.